Author: asomers
Date: Tue Jun 9 19:41:16 2015
New Revision: 284191
URL: https://svnweb.freebsd.org/changeset/base/284191
Log:
MFC r283115
Properly null-terminate strings in a kernel dump header. A version string
longer than 192 bytes will cause the version field of a dump header to
overflow. strncpy doesn't null terminate it, so savecore will print a
corrupted info file. Using strlcpy fixes the bug.
Modified:
stable/10/sys/kern/kern_shutdown.c
Directory Properties:
stable/10/ (props changed)
Modified: stable/10/sys/kern/kern_shutdown.c
==============================================================================
--- stable/10/sys/kern/kern_shutdown.c Tue Jun 9 19:22:13 2015
(r284190)
+++ stable/10/sys/kern/kern_shutdown.c Tue Jun 9 19:41:16 2015
(r284191)
@@ -882,16 +882,16 @@ mkdumpheader(struct kerneldumpheader *kd
{
bzero(kdh, sizeof(*kdh));
- strncpy(kdh->magic, magic, sizeof(kdh->magic));
- strncpy(kdh->architecture, MACHINE_ARCH, sizeof(kdh->architecture));
+ strlcpy(kdh->magic, magic, sizeof(kdh->magic));
+ strlcpy(kdh->architecture, MACHINE_ARCH, sizeof(kdh->architecture));
kdh->version = htod32(KERNELDUMPVERSION);
kdh->architectureversion = htod32(archver);
kdh->dumplength = htod64(dumplen);
kdh->dumptime = htod64(time_second);
kdh->blocksize = htod32(blksz);
- strncpy(kdh->hostname, prison0.pr_hostname, sizeof(kdh->hostname));
- strncpy(kdh->versionstring, version, sizeof(kdh->versionstring));
+ strlcpy(kdh->hostname, prison0.pr_hostname, sizeof(kdh->hostname));
+ strlcpy(kdh->versionstring, version, sizeof(kdh->versionstring));
if (panicstr != NULL)
- strncpy(kdh->panicstring, panicstr, sizeof(kdh->panicstring));
+ strlcpy(kdh->panicstring, panicstr, sizeof(kdh->panicstring));
kdh->parity = kerneldump_parity(kdh);
}
_______________________________________________
svn-src-all@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/svn-src-all
To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
